This page explains how tolinax UG (haftungsbeschränkt) protects the data you entrust to the aYOUne platform: where it is processed, which security measures apply, which service providers are involved and how you can reach us.
At a glance
- Hosting in Germany: compute, database and file storage run in the Google Cloud region europe-west3 (Frankfurt am Main).
- Tenant isolation: every record belongs to exactly one customer; every data access is limited to the signed-in user's customer.
- Encryption: HTTPS/TLS for all connections, encryption at rest for database, backups and files, additional AES-256-GCM encryption for stored credentials.
- Access control: fine-grained, role-based rights on every interface; second factor with authenticator app, YubiKey or passkey.
- Data subject rights: built-in export and erasure of personal data.
- Incident notification: customers are informed without undue delay and no later than 48 hours after we become aware of a personal data breach.
Security and privacy policies
Our information security programme is documented in the following policies (in English), approved by the Managing Director and reviewed at least annually:
- Information Security Policy
- Access Control Policy
- Data Classification and Encryption Policy
- Network Security and Monitoring Policy
- Incident Response Policy
- Vulnerability Management Policy
- Data Retention and Deletion Policy
- Internal Data Protection Policy
Data processing agreement
Where we process personal data on behalf of our customers, we conclude a data processing agreement under Art. 28 GDPR. The agreement is available in German, including the annexes on technical and organisational measures and sub-processors: Auftragsverarbeitungsvertrag (AVV). An English summary of the annexes follows below; please contact us for a copy prepared for your company.
Technical and Organisational Measures (Art. 32 GDPR)
Version: October 2026 · Owner: Managing Director
We do not operate our own data centres. Compute, database and file storage run on Google Cloud and MongoDB Atlas in the Frankfurt am Main region (Germany); the physical and environmental security of these facilities is provided by the providers and independently audited (including ISO/IEC 27001 and SOC 2).
1. Confidentiality (Art. 32(1)(b) GDPR)
Physical access: data-centre access control by the providers (access systems, video surveillance, security staff, logging). No servers or storage media with customer data in our offices.
System access: central sign-in; passwords stored only as bcrypt hashes; second factor available (authenticator app/TOTP, YubiKey, WebAuthn/passkeys); lockout after repeated failed attempts and rate limits on sign-in and second-factor endpoints; short-lived access tokens (15 minutes) with rotating, individually revocable refresh tokens. Workplaces: active anti-malware protection with automatic updates, automatic screen lock, password manager, and multi-factor authentication on all company, cloud, source-control and database-console accounts.
Data access: role-based access control with fine-grained rights per data object and action, enforced on every API; effective rights are limited to the modules licensed by the customer; records can be restricted to named users or teams; a separate account type with its own rights catalogue for operator functions; production access only for named individuals, granted on a need-to-know basis, revoked on exit or role change, reviewed at least every six months.
Separation: every record carries its tenant identifier and the shared data-access layer limits every query to the signed-in user's tenant; separate test and demonstration tenants with test data only; workloads separated on dedicated node pools.
Pseudonymisation and encryption (Art. 32(1)(a) GDPR): transport encryption only (HTTPS/TLS, HTTP redirected, HSTS one year including subdomains) and encrypted database connections; encryption at rest of database, backups and file storage (AES-256, provider-managed); third-party credentials additionally encrypted at application level (AES-256-GCM) with an optional end-to-end mode (PBKDF2-SHA256 with 600,000 iterations, AES-256-GCM) in which the server cannot decrypt; data-subject exports encrypted and delivered through time-limited signed links; pseudonymisation and blocking instead of deletion where statutory retention applies.
2. Integrity (Art. 32(1)(b) GDPR)
Transfer control: public access only through one central, managed ingress gateway, services are not individually exposed; internal metrics endpoints blocked from outside; block lists for abusive sources; inbound webhooks accepted only with a valid provider signature; disclosure to sub-processors only as listed.
Input control: sign-in events and API actions logged with user, tenant, IP address and time; change history on records (creator, last editor, timestamps); data-subject erasure runs with an audit trail.
3. Availability and resilience (Art. 32(1)(b) GDPR)
Managed Kubernetes with automatic health and readiness checks; managed database with replication and automatic provider backups; rate limiting on all APIs; Prometheus/Alertmanager monitoring with real-time alerting; runtime errors captured automatically as tracked tasks; public status page; automated build and deployment from version control.
4. Rapid restoration (Art. 32(1)(c) GDPR)
Database restore from provider backups; per-tenant backups on request and on a schedule with a per-tenant retention rule; services restored by redeploying versioned container images.
5. Regular testing and evaluation (Art. 32(1)(d) GDPR)
Published information security policy with sub-policies, reviewed at least annually; internal security audits with tracked findings and re-verification after remediation, with target times by severity (critical 7 days, high 30 days, medium 90 days); vulnerability reporting via security@aYOUne.com and security.txt; incident management with defined roles, a breach register and notification deadlines (customers within 48 hours at the latest); privacy by default: personal data is marked in the data catalogue as the basis for export and erasure.
6. Processing on instructions
Processing only on the customer's instructions under the data processing agreement; all staff and contractors bound to confidentiality and the internal data protection policy; sub-processors selected with regard to data protection and bound by the providers' data processing terms; third-country transfers only on the basis of an adequacy decision (including the EU-U.S. Data Privacy Framework) or the EU Standard Contractual Clauses 2021.
Sub-processors and third-country transfers
Version: October 2026
A. Core operation (always used)
| Provider | Service | Location of processing | Basis |
|---|---|---|---|
| Google Cloud | Compute (Kubernetes), file storage, network | Frankfurt am Main, Germany (europe-west3) | Provider's data processing terms (Cloud Data Processing Addendum) |
| MongoDB Atlas | Database, database backups | Frankfurt am Main, Germany (on Google Cloud, europe-west3) | Provider's data processing terms (Data Processing Agreement) |
| Hetzner Online | Relay of real-time connections (audio/video, remote support), build infrastructure | Germany | Provider's data processing terms |
B. Additional features (only when used by the customer)
| Provider | Service | Location / third country | Basis for third-country transfer |
|---|---|---|---|
| OpenAI | AI text processing, embeddings, speech | USA possible | EU-U.S. Data Privacy Framework where certified, otherwise EU Standard Contractual Clauses 2021 |
| Anthropic | AI text processing | USA possible | as above |
| Google (Gemini / Vertex AI) | AI text processing, speech | EU/USA possible | as above |
| Cohere | AI embeddings and text processing | Canada/USA possible | Adequacy decision (Canada) or as above |
| Voyage AI | AI embeddings | USA possible | as above |
| Amazon Web Services (Polly) | Text-to-speech | EU/USA possible | as above |
| ElevenLabs | Text-to-speech, voice cloning | USA possible | as above; biometric data only with the data subject's consent |
| HeyGen | Avatar and video generation | USA possible | as above; biometric data only with the data subject's consent |
| Twilio | Telephony, SMS | USA possible | as above |
| SparkPost | E-mail delivery | USA possible | as above |
For transfers based on the Standard Contractual Clauses we carry out a documented transfer impact assessment.
C. Services connected by the customer
Services that the customer connects with its own accounts (for example its own payment providers such as Stripe, PayPal or SumUp, its own mailboxes, messenger accounts, advertising and shop platforms) are not our sub-processors; the contractual relationship exists directly between the customer and that provider.
D. Changes
We announce changes to this list at least 30 days in advance. The current list is published at https://ayoune.com/en/trust.
Certifications
tolinax currently holds no ISO 27001, ISO 27701 or SOC 2 certification of its own. Our controls follow Art. 32 GDPR and are documented in the policies above. Our infrastructure providers Google Cloud and MongoDB Atlas are independently certified (including ISO/IEC 27001 and SOC 2).
Contact
- Security reports and vulnerabilities: security@ayoune.com (also listed in
/.well-known/security.txt) - Privacy questions and data subject requests: privacy@tolinax.com
- Privacy policy: ayoune.com/en/privacy · Legal notice: ayoune.com/en/impressum
Last updated: October 2026